MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains numerous external links, including one pointing to 'kuzutuzo.ru', which is likely part of a link farm or phishing campaign. The document body, though heavily obfuscated, suggests a lure related to 'Beethoven sonatas sheet music book', indicating a deceptive social engineering tactic.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=beethoven+sonatas+sheet+music+book
- https://wokopapun.weebly.com/uploads/1/3/5/3/135388848/gaxano.pdf
- https://bozetefaz.weebly.com/uploads/1/3/4/7/134733050/vuximagegidutedom.pdf
- http://logoped-samara.ru/what_is_the_main_message_of_the_book_of_genesis91whv.pdf
- https://cdn-cms.f-static.net/uploads/4470523/normal_603cbe8122d26.pdf
- http://wanebiwadu.iblogger.org/zibokuluvafiwevo.pdf
- http://my-credit.info/mackie_profx8v2_8-channel_professional_fx_mixer_with_usb_reviewa61lm.pdf
- https://cdn-cms.f-static.net/uploads/4383131/normal_5fe6c28452659.pdf
- https://nibawomufexax.weebly.com/uploads/1/3/4/3/134371272/pebadegigiwomum-bijimovofojop-wemupeb-relurevaz.pdf
- http://marafonsport.site/wunimibuzaxamoyqjok.pdf
- https://cdn-cms.f-static.net/uploads/4416144/normal_6023345edc0db.pdf
- https://cdn-cms.f-static.net/uploads/4388416/normal_600f90235d47d.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://vawigopowapab.rf.gd/54073282511.pdf
- https://s3.amazonaws.com/nowonovege/videoder_12._2_apk_2019.pdf
- https://s3.amazonaws.com/tuxutedi/geometry_worksheet_angles_of_polygons_review.pdf
- https://s3.amazonaws.com/kakekojezutok/jigsaw_template_20_pieces.pdf
- https://s3.amazonaws.com/nuxomigo/driver_s_permit_manual_book.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eab9.bin37f8055c72f7cce87bb17836b10eec437b152b1d16f51a3f150ce16e29ea423d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAB9 | 5224 bytes |
font_01_sfnt_off0000fc69.bind72058c80e93fd73b3c2a87fcf7e312ccb0ac9047944dae4530ec6566188859a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC69 | 10816 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.